@vellumai/assistant 0.11.3 → 0.11.4-dev.202608190019.b94dbf2

package/src/persistence/message-reads.ts

@@ -0,0 +1,211 @@
+/**
+ * Named read accessors for the `messages` table.
+ *
+ * Every row in `messages` is conversation content in some state of
+ * completeness: `finalized = 1` rows are immutable history, `finalized = 0`
+ * rows are still being written and their `content` may be a `{ ref }` into an
+ * in-flight delta file that disappears when the turn completes. Ad-hoc queries
+ * tend to encode a visibility decision without stating it; each accessor here
+ * states its decision in its name and contract, so a caller (and a reviewer)
+ * chooses between "completed history" and "any row" deliberately.
+ *
+ * Conversation-history reads (transcripts, lineage, pagination) stay with
+ * `getMessages` / `getMessagesAfter` / `getMessagesPaginated` in
+ * `conversation-crud.ts`, which also own fork-lineage resolution. This module
+ * is for the narrower point lookups and aggregates that other persistence
+ * modules need.
+ *
+ * Correlated subqueries embedded inside larger SQL (usage accounting's
+ * turn-index arithmetic, search candidate joins, `message_count` projections)
+ * are out of scope: extracting them would restructure their host queries. They
+ * carry their visibility decision as a comment at the site instead.
+ */
+
+import { and, desc, eq, inArray, lt, sql } from "drizzle-orm";
+
+import { type DrizzleDb, getDb } from "./db-connection.js";
+import { messages } from "./schema/index.js";
+
+/** `(id, createdAt)` of a message, the shape cursor and watermark logic needs. */
+export interface MessageRef {
+  id: string;
+  createdAt: number;
+}
+
+/**
+ * Structural read handle: anything that can `select` like the shared
+ * connection, which includes the connection itself and an open transaction.
+ * Every accessor takes `opts.db` with this type and defaults to the shared
+ * connection, so a caller holding its own handle (a transaction, an injected
+ * or in-memory database) reads the same database it writes.
+ */
+export type MessageReadHandle = Pick<DrizzleDb, "select">;
+
+/**
+ * The newest completed assistant message in a conversation, or null when it
+ * has none.
+ *
+ * Finalized-only: an assistant row that is still streaming is not a reply yet,
+ * so consumers tracking "the latest reply" (read/unread watermarks, previews)
+ * must not anchor on it. The row qualifies on its own once the turn completes.
+ *
+ * `db` lets a caller inside a transaction read through its own handle.
+ */
+export function latestAssistantMessage(
+  conversationId: string,
+  opts?: { db?: MessageReadHandle },
+): MessageRef | null {
+  return newestFinalizedAssistantRow(conversationId, opts?.db ?? getDb());
+}
+
+/**
+ * The newest completed assistant message strictly before `createdAt`, or null.
+ * Strict comparison: rewind logic that landed on a same-timestamp sibling
+ * would classify the latest reply as already seen.
+ */
+export function latestAssistantMessageBefore(
+  conversationId: string,
+  createdAt: number,
+  opts?: { db?: MessageReadHandle },
+): MessageRef | null {
+  return newestFinalizedAssistantRow(
+    conversationId,
+    opts?.db ?? getDb(),
+    createdAt,
+  );
+}
+
+function newestFinalizedAssistantRow(
+  conversationId: string,
+  db: MessageReadHandle,
+  strictlyBefore?: number,
+): MessageRef | null {
+  const row = db
+    .select({ id: messages.id, createdAt: messages.createdAt })
+    .from(messages)
+    .where(
+      and(
+        eq(messages.conversationId, conversationId),
+        eq(messages.role, "assistant"),
+        eq(messages.finalized, 1),
+        ...(strictlyBefore === undefined
+          ? []
+          : [lt(messages.createdAt, strictlyBefore)]),
+      ),
+    )
+    .orderBy(desc(messages.createdAt), desc(messages.id))
+    .limit(1)
+    .get();
+  return row ?? null;
+}
+
+/**
+ * Raw `content` of the last user-role row in a conversation, in insertion
+ * order (`rowid DESC`, not `createdAt`), or null when there is none.
+ *
+ * Insertion order is load-bearing for the undo path this serves: same-
+ * millisecond rows must resolve to the one written last. User rows are always
+ * written finalized, so no completeness predicate applies; only assistant
+ * turns stream.
+ */
+export function latestUserMessageRawContent(
+  conversationId: string,
+  opts?: { db?: MessageReadHandle },
+): string | null {
+  const row = (opts?.db ?? getDb())
+    .select({ content: messages.content })
+    .from(messages)
+    .where(
+      and(
+        eq(messages.conversationId, conversationId),
+        eq(messages.role, "user"),
+      ),
+    )
+    .orderBy(sql`rowid DESC`)
+    .limit(1)
+    .get();
+  return row?.content ?? null;
+}
+
+/**
+ * Per-conversation count and latest timestamp of rows with `role`, for the
+ * given conversations.
+ *
+ * Any-state deliberately: these aggregates feed list ordering and previews,
+ * where a streaming reply still counts as activity. A caller needing
+ * completed-only aggregates should say so here rather than post-filtering.
+ */
+export function countMessagesByRoleForConversations(
+  conversationIds: string[],
+  role: string,
+  opts?: { db?: MessageReadHandle },
+): Map<string, { count: number; lastAt: number }> {
+  if (conversationIds.length === 0) {
+    return new Map();
+  }
+  const rows = (opts?.db ?? getDb())
+    .select({
+      conversationId: messages.conversationId,
+      count: sql<number>`COUNT(*)`.as("count"),
+      lastAt: sql<number>`MAX(${messages.createdAt})`.as("last_at"),
+    })
+    .from(messages)
+    .where(
+      and(
+        inArray(messages.conversationId, conversationIds),
+        eq(messages.role, role),
+      ),
+    )
+    .groupBy(messages.conversationId)
+    .all();
+  return new Map(
+    rows.map((r) => [
+      r.conversationId,
+      { count: Number(r.count), lastAt: Number(r.lastAt) },
+    ]),
+  );
+}
+
+/**
+ * Which of `messageIds` exist as rows, in any state.
+ *
+ * Any-state deliberately: existence is the question (orphan detection for
+ * rows referencing messages), and a streaming row exists. An empty input
+ * returns an empty set without querying.
+ */
+export function existingMessageIds(
+  messageIds: string[],
+  opts?: { db?: MessageReadHandle },
+): Set<string> {
+  if (messageIds.length === 0) {
+    return new Set();
+  }
+  return new Set(
+    (opts?.db ?? getDb())
+      .select({ id: messages.id })
+      .from(messages)
+      .where(inArray(messages.id, messageIds))
+      .all()
+      .map((r) => r.id),
+  );
+}
+
+/**
+ * The conversation that owns `messageId`, in any state, or null when the
+ * message does not exist.
+ *
+ * Any-state deliberately: callers hold an id the user acted on (a bookmark on
+ * a rendered row, an attachment link), and a rendered row may still be
+ * streaming.
+ */
+export function messageConversationId(
+  messageId: string,
+  opts?: { db?: MessageReadHandle },
+): string | null {
+  const row = (opts?.db ?? getDb())
+    .select({ conversationId: messages.conversationId })
+    .from(messages)
+    .where(eq(messages.id, messageId))
+    .get();
+  return row?.conversationId ?? null;
+}

package/src/persistence/migrations/360-add-document-workspace-path.ts

@@ -7,20 +7,11 @@ const COLUMN_DEFINITION = "workspace_path TEXT";
 /**
  * Add `workspace_path` to `documents` and enforce one document per file.
  *
- * The column holds the workspace-relative path of the markdown file a document
- * is bound to. It is set when a client opens a workspace `.md` file through
- * `POST /v1/documents/for-workspace-file`, which gives the file a document
- * identity so comments, assistant iteration, and PDF export — all keyed off a
- * document id — work on it. Documents that have no file behind them (assistant
- * drafts, client-created surfaces) stay NULL.
- *
- * The unique index is partial (`WHERE workspace_path IS NOT NULL`) so the many
- * NULL rows stay unconstrained while a given file resolves to exactly one
- * document. The find-or-create route depends on that uniqueness for its
- * idempotency.
- *
- * Nullable with no backfill: nothing recorded a file binding before this
- * column existed, so pre-existing rows correctly stay NULL.
+ * The column and its partial unique index are unused by the daemon: no code
+ * reads or writes them. Some rows carry a non-NULL path; new rows stay NULL.
+ * The migration stays in the chain because migrations are append-only, and the
+ * drizzle model in `schema/documents.ts` carries the column so it keeps
+ * describing the physical table.
  *
  * Idempotent: the column add is guarded with `tableHasColumn` and the index
  * with `IF NOT EXISTS`, so a crash between the two does not break the next

package/src/persistence/migrations/366-chatgpt-subscription-row-identity.test.ts

@@ -0,0 +1,120 @@
+import { Database } from "bun:sqlite";
+import { describe, expect, test } from "bun:test";
+
+import { drizzle } from "drizzle-orm/bun-sqlite";
+
+import * as schema from "../schema.js";
+import { migrateChatgptSubscriptionRowIdentity } from "./366-chatgpt-subscription-row-identity.js";
+
+function createTestDb() {
+  const sqlite = new Database(":memory:");
+  sqlite.exec(/*sql*/ `
+    CREATE TABLE provider_connections (
+      name        TEXT PRIMARY KEY,
+      provider    TEXT NOT NULL,
+      auth        TEXT NOT NULL,
+      label       TEXT,
+      base_url    TEXT,
+      models      TEXT,
+      created_at  INTEGER NOT NULL,
+      updated_at  INTEGER NOT NULL
+    );
+  `);
+  return { sqlite, db: drizzle(sqlite, { schema }) };
+}
+
+function insertRow(
+  sqlite: Database,
+  name: string,
+  provider: string,
+  auth: string,
+): void {
+  sqlite
+    .query(
+      /*sql*/ `INSERT INTO provider_connections (name, provider, auth, created_at, updated_at)
+       VALUES (?, ?, ?, 1, 1)`,
+    )
+    .run(name, provider, auth);
+}
+
+function readProvider(sqlite: Database, name: string): string | undefined {
+  const row = sqlite
+    .query(`SELECT provider FROM provider_connections WHERE name = ?`)
+    .get(name) as { provider: string } | null;
+  return row?.provider;
+}
+
+describe("migration 366: chatgpt-subscription row identity", () => {
+  test("flips the subscription row to provider chatgpt", () => {
+    const { sqlite, db } = createTestDb();
+    insertRow(
+      sqlite,
+      "chatgpt-subscription",
+      "openai",
+      '{"type":"oauth_subscription","credential":"credential/chatgpt/access_token"}',
+    );
+
+    migrateChatgptSubscriptionRowIdentity(db);
+
+    expect(readProvider(sqlite, "chatgpt-subscription")).toBe("chatgpt");
+  });
+
+  test("leaves a claiming row with key auth untouched", () => {
+    const { sqlite, db } = createTestDb();
+    insertRow(
+      sqlite,
+      "chatgpt-subscription",
+      "openai",
+      '{"type":"api_key","credential":"vault/openai"}',
+    );
+
+    migrateChatgptSubscriptionRowIdentity(db);
+
+    expect(readProvider(sqlite, "chatgpt-subscription")).toBe("openai");
+  });
+
+  test("leaves other rows untouched", () => {
+    const { sqlite, db } = createTestDb();
+    insertRow(sqlite, "openai-key", "openai", '{"type":"api_key"}');
+    insertRow(sqlite, "vellum", "vellum", '{"type":"platform"}');
+
+    migrateChatgptSubscriptionRowIdentity(db);
+
+    expect(readProvider(sqlite, "openai-key")).toBe("openai");
+    expect(readProvider(sqlite, "vellum")).toBe("vellum");
+  });
+
+  test("leaves unparseable auth untouched", () => {
+    const { sqlite, db } = createTestDb();
+    insertRow(sqlite, "chatgpt-subscription", "openai", "not json");
+
+    migrateChatgptSubscriptionRowIdentity(db);
+
+    expect(readProvider(sqlite, "chatgpt-subscription")).toBe("openai");
+  });
+
+  test("is idempotent", () => {
+    const { sqlite, db } = createTestDb();
+    insertRow(
+      sqlite,
+      "chatgpt-subscription",
+      "openai",
+      '{"type":"oauth_subscription"}',
+    );
+
+    migrateChatgptSubscriptionRowIdentity(db);
+    migrateChatgptSubscriptionRowIdentity(db);
+
+    expect(readProvider(sqlite, "chatgpt-subscription")).toBe("chatgpt");
+  });
+
+  test("no-ops without the table or the row", () => {
+    const bare = new Database(":memory:");
+    expect(() =>
+      migrateChatgptSubscriptionRowIdentity(drizzle(bare, { schema })),
+    ).not.toThrow();
+
+    const { db } = createTestDb();
+    expect(() => migrateChatgptSubscriptionRowIdentity(db)).not.toThrow();
+  });
+});

package/src/persistence/migrations/366-chatgpt-subscription-row-identity.ts

@@ -0,0 +1,62 @@
+import { type DrizzleDb, getSqliteFrom } from "../db-connection.js";
+
+/**
+ * Stamp the ChatGPT-subscription row with its own provider identity.
+ *
+ * The row is the subscription route by definition (auth modality = provider
+ * identity), but it historically stored `provider: "openai"` and was found
+ * by name, which left provider "openai" ambiguous on disk: a BYOK api_key
+ * row and the subscription row read identically at the provider column.
+ * With the row carrying `provider: "chatgpt"`, auth type is derivable from
+ * the provider for every row, and provider-keyed scans for "openai" no
+ * longer surface the subscription row.
+ *
+ * Scoped tightly: only the canonical row name with oauth_subscription auth
+ * is flipped. A claiming row under the same name with key auth is an
+ * ordinary connection and keeps its provider. Idempotent: a flipped row no
+ * longer matches, and the table-exists guard covers databases from before
+ * migration 243.
+ */
+export function migrateChatgptSubscriptionRowIdentity(
+  database: DrizzleDb,
+): void {
+  const raw = getSqliteFrom(database);
+
+  const tableExists = raw
+    .query(
+      `SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'provider_connections'`,
+    )
+    .get();
+  if (!tableExists) {
+    return;
+  }
+
+  const row = raw
+    .query(
+      `SELECT provider, auth FROM provider_connections WHERE name = 'chatgpt-subscription'`,
+    )
+    .get() as { provider: string; auth: string } | null;
+  if (!row || row.provider !== "openai") {
+    return;
+  }
+
+  let authType: unknown;
+  try {
+    const parsed: unknown = JSON.parse(row.auth);
+    authType =
+      parsed !== null && typeof parsed === "object"
+        ? (parsed as { type?: unknown }).type
+        : undefined;
+  } catch {
+    return;
+  }
+  if (authType !== "oauth_subscription") {
+    return;
+  }
+
+  raw
+    .prepare(
+      `UPDATE provider_connections SET provider = 'chatgpt', updated_at = ? WHERE name = 'chatgpt-subscription'`,
+    )
+    .run(Date.now());
+}

package/src/persistence/real-user-turn-filter.ts

@@ -19,8 +19,32 @@ import { sql } from "drizzle-orm";
 export function realUserTurnContentFilter(
   alias: string,
 ): ReturnType<typeof sql> {
-  return sql.raw(
-    `${alias}.content NOT LIKE '%"type":"tool\\_result"%' ESCAPE '\\' ` +
-      `AND ${alias}.content NOT LIKE '%"type":"web\\_search\\_tool\\_result"%' ESCAPE '\\'`,
+  return sql.raw(realUserTurnContentFilterSql(alias));
+}
+
+/**
+ * Raw-string form of {@link realUserTurnContentFilter}, for queries built as
+ * plain SQL template strings (`rawAll` sites). Same fragment, one source.
+ *
+ * `finalized = 1`: the grouped tool-result row is a USER-role row reserved
+ * in-flight (`ensureToolResultRowReserved`), and while it streams its content
+ * is a `{ ref }` pointer that does not contain the tool_result text the
+ * exclusions match. Without this predicate it counts as a real user turn
+ * mid-tool-execution and stops counting once the content folds inline.
+ *
+ * Bare `[]` content is deliberately NOT excluded: a hidden send persists its
+ * user row with empty display content (`processMessage` with
+ * `displayContent: ""`) and still runs a turn, so `[]` rows are legitimate
+ * turns. The cost is a narrow pre-existing window in the writer-creation
+ * fallback, where the tool-result row is born finalized with a `[]`
+ * placeholder and counts until the first content write lands; that window is
+ * rare (writer creation failure only) and transient, and closing it needs a
+ * signal that distinguishes the placeholder from a real empty-display turn.
+ */
+export function realUserTurnContentFilterSql(alias: string): string {
+  return (
+    `${alias}.finalized = 1 ` +
+    `AND ${alias}.content NOT LIKE '%"type":"tool\\_result"%' ESCAPE '\\' ` +
+    `AND ${alias}.content NOT LIKE '%"type":"web\\_search\\_tool\\_result"%' ESCAPE '\\'`
   );
 }

package/src/persistence/schema/documents.ts

@@ -22,13 +22,13 @@ export const documents = sqliteTable(
     wordCount: integer("word_count").notNull().default(0),
     createdAt: integer("created_at").notNull(),
     updatedAt: integer("updated_at").notNull(),
-    // Workspace-relative path of the markdown file this document is bound to.
-    // NULL for documents with no file behind them.
+    // Unused by the daemon: no code reads or writes the column, and some rows
+    // carry a non-NULL path. It stays in the model because migration 360 puts
+    // it in the physical table and the model must keep describing that table.
     workspacePath: text("workspace_path"),
   },
   (table) => [
-    // Partial so the many file-less documents stay unconstrained while a given
-    // file resolves to exactly one document.
+    // Partial, so the NULL rows stay unconstrained.
     uniqueIndex("idx_documents_workspace_path")
       .on(table.workspacePath)
       .where(sql`workspace_path IS NOT NULL`),

package/src/persistence/steps.ts

@@ -473,6 +473,7 @@ import { migrateAddConversationSubagentKind } from "./migrations/362-add-convers
 import { migrateBackfillScheduleInferenceProfile } from "./migrations/363-backfill-schedule-inference-profile.js";
 import { migrateAddScheduleSourceKey } from "./migrations/364-add-schedule-source-key.js";
 import { migrateAddConversationForkStrategy } from "./migrations/365-add-conversation-fork-strategy.js";
+import { migrateChatgptSubscriptionRowIdentity } from "./migrations/366-chatgpt-subscription-row-identity.js";
 import type { MigrationStep } from "./migrations/run-migrations.js";
 
 export const migrationSteps: MigrationStep[] = [
@@ -1573,4 +1574,12 @@ export const migrationSteps: MigrationStep[] = [
   },
   migrateAddScheduleSourceKey,
   migrateAddConversationForkStrategy,
+  {
+    name: "migrateChatgptSubscriptionRowIdentity",
+    run: migrateChatgptSubscriptionRowIdentity,
+    // The table-exists guard treats a missing table as nothing-to-do, so the
+    // creating migration must be checkpointed first or a repair flow could
+    // permanently checkpoint the no-op.
+    dependsOn: ["migrateCreateProviderConnections"],
+  },
 ];

package/src/plugin-api/__tests__/oauth-callback-url-export.test.ts

@@ -0,0 +1,29 @@
+/**
+ * Guards that `resolveOauthCallbackUrl` reaches plugins.
+ *
+ * The shim written into `<workspaceDir>/node_modules/@vellumai/plugin-api`
+ * re-binds whatever `Object.keys()` finds on the plugin-api namespace, so an
+ * export missing from `index.ts` is missing from every installed plugin with
+ * no other signal than a plugin failing to import it.
+ */
+
+import { describe, expect, test } from "bun:test";
+
+import { PLUGIN_API_EXPORTS } from "../../embedded/plugin-api.js";
+import * as pluginApi from "../index.js";
+
+describe("plugin-api OAuth callback export", () => {
+  test("is exported from the plugin-api surface", () => {
+    expect(typeof pluginApi.resolveOauthCallbackUrl).toEqual("function");
+  });
+
+  test("is carried into the generated shim's binding list", () => {
+    expect(PLUGIN_API_EXPORTS).toContain("resolveOauthCallbackUrl");
+  });
+
+  test("takes no arguments, so a plugin cannot vary the URI", () => {
+    // The value a Client ID Metadata Document publishes and the value the
+    // host later authorizes with have to be the same string.
+    expect(pluginApi.resolveOauthCallbackUrl.length).toEqual(0);
+  });
+});

package/src/plugin-api/constants.ts

@@ -39,6 +39,14 @@ export const HOOKS = {
 /** Union of every hook name declared in {@link HOOKS}. */
 export type HookName = (typeof HOOKS)[keyof typeof HOOKS];
 
+/**
+ * Message kind for the hidden user row that starts a voice escalation leg.
+ * Hooks use this marker to distinguish the continuation instruction from
+ * other transcript-suppressed prompts without depending on host voice code.
+ */
+export const VOICE_ESCALATION_CONTINUATION_MESSAGE_KIND =
+  "voice_escalation_continuation";
+
 /**
  * Appended (inside the `<system_notice>` wrapper) to the internal continuation /
  * completion nudge strings that re-query the model. Those notices are injected